Each individual NIC in the group can have two addresses: the shared address of the devices in the group, assigned to the carpN device, plus an individual address for the backing device.

In my carp(4) deployments, I've only ever used addresses in the same subnet, primarily to avoid confusing myself. But as stated, this is not a necessity. Their unique "home" addresses do not need to be in the same subnet as their shared address. And they do not even require a unique address on their NICs. For example, they do not need unique addresses if they can be reached individually via a different NIC.

-----

Edited to add:

Having a carpN device and a backing NIC on the same subnet is one of the few cases where two NICs can share the same subnet.

Yes, both the carpN device and the backing device can also have their own IPv4 alias addresses, and each can have its own flight of IPv6 addresses.